Is Ali Hunter - Aliexpress Dropshipping Center safe?
Ali Hunter - Aliexpress Dropshipping Center is medium risk. On AliExpress pages, the extension rewrites every product link to carry its own key via s.click.aliexpress.com, before you click. The redirect sets attribution to the extension's key and a ~68-year cookie; any prior affiliate ID is dropped.
Who publishes itHunt_S - 3 other listings from the same operator, 2 of them carrying a finding
Hunt_S - 3 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 14k+ users between them. 2 of them carry a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliExpress Links Rewritten to the Extension's Own Affiliate Redirect
On AliExpress pages, the extension rewrites every product link to carry its own key via s.click.aliexpress.com, before you click.
The redirect sets attribution to the extension's key and a ~68-year cookie; any prior affiliate ID is dropped.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open any AliExpress product page or search results page, or scroll to load more products.
The content script replaces every AliExpress product link's destination with a URL on s.click.aliexpress.com carrying the extension's own affiliate key, before you click anything.
Runs immediately on page load, then again on every DOM mutation via a MutationObserver, so newly-loaded product cards are rewritten too.
All 20 product links sampled on a live AliExpress search results page had already been rewritten to the affiliate redirect URL before any click; zero of 20 still pointed directly at aliexpress.com/item/.
- Target
- Product links on AliExpress search and item pages, e.g. aliexpress.com/w/wholesale-wireless-earbuds.html
<a href="https://www.aliexpress.com/item/1005011654083615.html">...</a><a href="https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_c3nfv9XL&dl_target_url=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005011654083615.html" data-affiliate-converted="true">...</a>302 redirect to https://www.aliexpress.com/item/1005011654083615.html with aff_fcid, aff_fsk, aff_platform=portals-tool, sk, and aff_trace_key all set to the extension's affiliate key _c3nfv9XL, plus tt=CPS_NORMAL and afSmartRedirect=y. The response also sets a Set-Cookie for aeu_cid on .aliexpress.com expiring 2094-09-04.
- Who gets credited for the saleaff_trace_key=...-_c3nfv9XL
Every parameter telling AliExpress which affiliate account gets paid a commission is set to the extension's own affiliate key.
- The product you were viewinghttps://www.aliexpress.com/item/1005011654083615.html
Carried through the redirect in the dl_target_url parameter, then again in the final landing URL.
- Referral cookie durationaeu_cid, expires 2094-09-04 (~68 years)
A cookie set on aliexpress.com keeps crediting this affiliate key for purchases made from this browser well into the future.
- AliExpress commission program flagtt=CPS_NORMAL
Marks the visit under AliExpress's standard commission-per-sale program.
The code that rewrites the link and the code that builds the affiliate URL.
affiliateUrl() — builds the redirect URL
affiliate.jsconst AE_KEY = "_c3nfv9XL";function isAlreadyAffiliate(host) { return /s\.click\.aliexpress\.com$/i.test(host);}function isProductPath(source, pathname, search) { switch (source) { case "aliexpress": return /\/item\/\d+\.html|\/i\/\d+\.html/.test(pathname); default: return false; }}function affiliateUrl(rawUrl) { if (!rawUrl || typeof rawUrl !== "string") { return rawUrl; } if (!/^https?:\/\//i.test(rawUrl)) { return rawUrl; } let parsed; try { parsed = new URL(rawUrl); } catch (_) { return rawUrl; } const host = parsed.host.toLowerCase(); if (isAlreadyAffiliate(host)) { return rawUrl; } const source = detectSource(host); if (!source) { return rawUrl; } if (!isProductPath(source, parsed.pathname, parsed.search)) { return rawUrl; } if (source === "aliexpress") { return ( "https://s.click.aliexpress.com/deep_link.htm?aff_short_key=" + encodeURIComponent(AE_KEY) + "&dl_target_url=" + encodeURIComponent(rawUrl) ); } return rawUrl;}convertLinks() — rewrites every link on the page
contentScript.jsfunction convertLinks() { const links = document.querySelectorAll("a[href]"); links.forEach(link => { const oldUrl = link.href; const newUrl = window.AliDownProAffiliate.affiliateUrl(oldUrl); if (newUrl && newUrl !== oldUrl) { link.href = newUrl; link.dataset.affiliateConverted = "true"; } });}convertLinks();const observer = new MutationObserver(() => { convertLinks();});observer.observe(document.documentElement, { childList: true, subtree: true});- s.click.aliexpress.com
AliExpress's own affiliate/CPS redirector. Every rewritten product link routes through this host, carrying the extension's affiliate key, before returning to the product page.